An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade protobuf | Apr 19, 2023 | Jan 10, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Dell Powerstore Dsa2024287 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jul 2, 2024 |
| Oracle Missing Cpu Apr 2022 | — | Apply the April 2022 Critical Patch Update (CPU) for Oracle Database | Apr 20, 2022 | Jan 7, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35227385 for version 14.1.1.0.0. | Jul 19, 2023 | Jan 7, 2022 |
| Suse | — | Upgrade protobuf-develUpgrade protobuf-javaUpgrade libprotobuf20-32bitUpgrade libprotoc20-32bitUpgrade python3-protobufUpgrade python2-protobufUpgrade libprotobuf-lite20-32bitUpgrade libprotobuf-lite20Upgrade libprotobuf20Upgrade protobuf-sourceUpgrade libprotoc20 | Nov 10, 2022 | Jan 10, 2022 |
| Ubuntu | — | Upgrade libprotobuf23Upgrade protobuf-compilerUpgrade libprotobuf-javaUpgrade libprotoc23Upgrade libprotobuf-lite23Upgrade python3-protobuf | Mar 22, 2023 | Jan 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub